Tech Support
Documentation
Login
Contact Us
GitHub Repositories Victimized Amid Supply Chain Attack
Wajahat Raja
October 12, 2023 - TuxCare expert team
In a digital landscape rife with vulnerabilities, a recent and disconcerting phenomenon has come to light. GitHub repositories, the foundation of numerous software projects, have been victimized by a devious supply chain attack. This well-planned supply chain attack on GitHub repositories, found in July 2023, involved the hacking of GitHub accounts as well as the covert introduction of harmful code disguised as Dependabot contributions.
As we go into the complexities of this danger, we’ll mention a related product of TuxCare, which provides a method to strengthen your Java library dependencies.
GitHub Repositories’ Supply Chain Attack Unveiled
The nefarious activity, which resembled a supply chain attack, began when cybersecurity researchers discovered unusual commits in hundreds of public and private repositories. These commits pretended to be real Dependabot contributions, leading unsuspecting devs astray. When defending against malicious Dependabots in GitHub projects, it’s crucial to be aware of GitHub security risks and supply chain vulnerabilities, especially in light of recent incidents involving malicious Dependabots.
Dependabot is a trusted GitHub ecosystem tool and plays an important role in screening projects for vulnerable dependencies. It generates pull requests automatically to update these dependencies, assuring project security and stability.
Malicious Intentions
However, the perpetrators in this nefarious campaign had other plans. Their goal was to steal sensitive information, particularly passwords, from developers. The malicious malware secretly transferred GitHub project secrets to a fake command and control server. Simultaneously, it altered existing JavaScript files in the targeted repositories, injecting malicious code into a web form password-stealer. This code lay in wait to capture passwords entered by unsuspecting users.
Infiltration and Impersonation
The attack began with the acquisition of personal GitHub access tokens, a move that went unnoticed. With these tokens in hand, the threat actors used automated scripts to create commit messages with the term “fix,” which alludes to the user account “dependabot[bot].” These forgeries acted as the entrance point for the injection of malicious code into repositories, kicking off their foul strategy.
The Secrets Exfiltration
The introduction of a GitHub action file named “hook.yml” aided in the retrieval of project secrets. Each time the code was pushed to the impacted repository, this file started a new procedure. This approach exposed the secrets to the hostile command and control server invisibly.
Password Steal
The password-stealing component, on the other hand, secretly injected obfuscated JavaScript into JavaScript (.js) files, which then retrieved a remote script. This remote script monitored form submissions, gathering passwords whenever users typed them into ‘password’ input fields.
The scope of this attack is what makes it so dangerous. Many compromised tokens granted access to both public and private GitHub repositories, resulting in a broad impact on GitHub repositories. Identifying and mitigating Dependabot-related threats is essential for safeguarding your GitHub repositories from potential attacks.
The Mystery of Token Theft
Despite extensive investigation, the specific technique by which the attackers stole these tokens remains a mystery. A possible explanation is that a malware infection, presumably transmitted via a malicious package, resulted in the exfiltration of personal access tokens (PATs) stored locally on developers’ machines. PATs, in particular, allow GitHub access without the need for two-factor authentication (2FA).
Surprisingly, the majority of compromised individuals were from Indonesia, implying a targeted operation aimed specifically at this demographic. However, the method of the heist remains unknown. Enhancing GitHub repository security post-supply chain attack becomes paramount to prevent future vulnerabilities.
A Broader Picture
This event highlights threat actors’ ongoing efforts to destabilize open-source ecosystems and compromise software supply chains. In a related development, a data exfiltration campaign targeting npm and PyPI has been identified. This campaign uses fake software to collect sensitive computer data and send it to a remote server. These occurrences highlight the importance of strong security procedures within the open-source community.
TuxCare’s Java Secure Chain: A Tangential Solution
Our innovative product, Java Secure Chain, provides a curated repository of Java libraries that have been thoroughly tested for vulnerabilities. It provides fixes for known weaknesses, ensuring that you have a repository for your dependencies that you can rely on. As the software industry faces supply chain difficulties, solutions such as Java Secure Chain provide protection against potential vulnerabilities in Java library dependencies.
Conclusion
Finally, the infiltration of the GitHub repositories by malicious Dependabot impersonations serves as a sharp warning of the increasing threats in the digital arena. Supply chain assaults continue to be a problem in the software development world. As we face these challenges, implementing secure solutions can strengthen our defenses, providing a safer and more resilient software environment for all.
Vigilance and proactive security measures are our most powerful allies in this ever-changing digital ecosystem. Explore best practices for supply chain protection in GitHub to proactively shield your projects against emerging threats.
Let us be cautious and work together to protect our digital endeavors from the ever-present threat of supply chain threats.
The sources for this piece include articles in Bleeping Computer and The Hacker News.
